package handlers

import (
	"database/sql"
	"fmt"
	"net/http"
	"strconv"
	"strings"

	"github.com/gin-gonic/gin"

	"git.gobha.me/xcaliber/chat-switchboard/database"
)

// ── Request types ───────────────────────────

type createTeamRequest struct {
	Name        string `json:"name" binding:"required,min=1,max=200"`
	Description string `json:"description,omitempty"`
}

type updateTeamRequest struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
	IsActive    *bool   `json:"is_active,omitempty"`
	Settings    *string `json:"settings,omitempty"` // JSON string
}

type addMemberRequest struct {
	UserID string `json:"user_id" binding:"required"`
	Role   string `json:"role" binding:"required,oneof=admin member"`
}

type updateMemberRequest struct {
	Role string `json:"role" binding:"required,oneof=admin member"`
}

// ── Handler ─────────────────────────────────

type TeamHandler struct{}

func NewTeamHandler() *TeamHandler { return &TeamHandler{} }

// ── Admin: List All Teams ───────────────────

func (h *TeamHandler) ListTeams(c *gin.Context) {
	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "50"))
	if page < 1 {
		page = 1
	}
	if perPage < 1 || perPage > 100 {
		perPage = 50
	}
	offset := (page - 1) * perPage

	var total int
	if err := database.DB.QueryRow(`SELECT COUNT(*) FROM teams`).Scan(&total); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to count teams"})
		return
	}

	rows, err := database.DB.Query(`
		SELECT t.id, t.name, t.description, t.created_by, t.is_active,
		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
		       COALESCE(mc.cnt, 0) AS member_count
		FROM teams t
		LEFT JOIN (
			SELECT team_id, COUNT(*) AS cnt FROM team_members GROUP BY team_id
		) mc ON mc.team_id = t.id
		ORDER BY t.name ASC
		LIMIT $1 OFFSET $2
	`, perPage, offset)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var teams []gin.H
	for rows.Next() {
		var id, name, desc, createdBy, settings string
		var isActive bool
		var memberCount int
		var createdAt, updatedAt sql.NullTime
		if err := rows.Scan(&id, &name, &desc, &createdBy, &isActive, &settings,
			&createdAt, &updatedAt, &memberCount); err != nil {
			continue
		}
		teams = append(teams, gin.H{
			"id":           id,
			"name":         name,
			"description":  desc,
			"created_by":   createdBy,
			"is_active":    isActive,
			"settings":     settings,
			"member_count": memberCount,
			"created_at":   createdAt.Time,
			"updated_at":   updatedAt.Time,
		})
	}
	if teams == nil {
		teams = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     teams,
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

// ── Admin: Create Team ──────────────────────

func (h *TeamHandler) CreateTeam(c *gin.Context) {
	adminID := getUserID(c)

	var req createTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	var id string
	err := database.DB.QueryRow(`
		INSERT INTO teams (name, description, created_by)
		VALUES ($1, $2, $3)
		RETURNING id
	`, req.Name, req.Description, adminID).Scan(&id)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create team"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id, "name": req.Name})
}

// ── Admin: Get Team ─────────────────────────

func (h *TeamHandler) GetTeam(c *gin.Context) {
	teamID := c.Param("id")

	var name, desc, createdBy, settings string
	var isActive bool
	var memberCount int
	var createdAt, updatedAt sql.NullTime

	err := database.DB.QueryRow(`
		SELECT t.name, t.description, t.created_by, t.is_active,
		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id)
		FROM teams t WHERE t.id = $1
	`, teamID).Scan(&name, &desc, &createdBy, &isActive, &settings,
		&createdAt, &updatedAt, &memberCount)
	if err == sql.ErrNoRows {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"id":           teamID,
		"name":         name,
		"description":  desc,
		"created_by":   createdBy,
		"is_active":    isActive,
		"settings":     settings,
		"member_count": memberCount,
		"created_at":   createdAt.Time,
		"updated_at":   updatedAt.Time,
	})
}

// ── Admin: Update Team ──────────────────────

func (h *TeamHandler) UpdateTeam(c *gin.Context) {
	teamID := c.Param("id")

	var req updateTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Build dynamic update
	sets := []string{}
	args := []interface{}{}
	argN := 1

	if req.Name != nil {
		sets = append(sets, "name = $"+strconv.Itoa(argN))
		args = append(args, *req.Name)
		argN++
	}
	if req.Description != nil {
		sets = append(sets, "description = $"+strconv.Itoa(argN))
		args = append(args, *req.Description)
		argN++
	}
	if req.IsActive != nil {
		sets = append(sets, "is_active = $"+strconv.Itoa(argN))
		args = append(args, *req.IsActive)
		argN++
	}
	if req.Settings != nil {
		sets = append(sets, "settings = $"+strconv.Itoa(argN)+"::jsonb")
		args = append(args, *req.Settings)
		argN++
	}

	if len(sets) == 0 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
		return
	}

	query := "UPDATE teams SET "
	for i, s := range sets {
		if i > 0 {
			query += ", "
		}
		query += s
	}
	query += " WHERE id = $" + strconv.Itoa(argN)
	args = append(args, teamID)

	res, err := database.DB.Exec(query, args...)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
}

// ── Admin: Delete Team ──────────────────────

func (h *TeamHandler) DeleteTeam(c *gin.Context) {
	teamID := c.Param("id")

	res, err := database.DB.Exec(`DELETE FROM teams WHERE id = $1`, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
}

// ── Members: List ───────────────────────────

func (h *TeamHandler) ListMembers(c *gin.Context) {
	teamID := getTeamID(c)

	rows, err := database.DB.Query(`
		SELECT tm.id, tm.user_id, tm.role, tm.joined_at,
		       u.email, COALESCE(u.display_name, '') AS display_name, u.role AS user_role
		FROM team_members tm
		JOIN users u ON u.id = tm.user_id
		WHERE tm.team_id = $1
		ORDER BY tm.role ASC, u.email ASC
	`, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var members []gin.H
	for rows.Next() {
		var id, userID, role, email, displayName, userRole string
		var joinedAt sql.NullTime
		if err := rows.Scan(&id, &userID, &role, &joinedAt, &email, &displayName, &userRole); err != nil {
			continue
		}
		members = append(members, gin.H{
			"id":           id,
			"user_id":      userID,
			"role":         role,
			"joined_at":    joinedAt.Time,
			"email":        email,
			"display_name": displayName,
			"user_role":    userRole,
		})
	}
	if members == nil {
		members = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{"data": members})
}

// ── Members: Add ────────────────────────────

func (h *TeamHandler) AddMember(c *gin.Context) {
	teamID := getTeamID(c)

	var req addMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Verify team exists
	var exists bool
	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM teams WHERE id = $1)`, teamID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	// Verify user exists
	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM users WHERE id = $1)`, req.UserID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusBadRequest, gin.H{"error": "user not found"})
		return
	}

	var id string
	err := database.DB.QueryRow(`
		INSERT INTO team_members (team_id, user_id, role)
		VALUES ($1, $2, $3)
		RETURNING id
	`, teamID, req.UserID, req.Role).Scan(&id)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "user is already a member"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to add member"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id})
}

// ── Members: Update Role ────────────────────

func (h *TeamHandler) UpdateMember(c *gin.Context) {
	memberID := c.Param("memberId")

	var req updateMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	res, err := database.DB.Exec(`
		UPDATE team_members SET role = $1 WHERE id = $2
	`, req.Role, memberID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
}

// ── Members: Remove ─────────────────────────

func (h *TeamHandler) RemoveMember(c *gin.Context) {
	memberID := c.Param("memberId")

	res, err := database.DB.Exec(`DELETE FROM team_members WHERE id = $1`, memberID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
}

// ── User: My Teams ──────────────────────────

func (h *TeamHandler) MyTeams(c *gin.Context) {
	userID := getUserID(c)

	rows, err := database.DB.Query(`
		SELECT t.id, t.name, t.description, t.is_active,
		       COALESCE(t.settings::text, '{}'),
		       tm.role AS my_role,
		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id) AS member_count
		FROM teams t
		JOIN team_members tm ON tm.team_id = t.id AND tm.user_id = $1
		WHERE t.is_active = true
		ORDER BY t.name ASC
	`, userID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var teams []gin.H
	for rows.Next() {
		var id, name, desc, settings, myRole string
		var isActive bool
		var memberCount int
		if err := rows.Scan(&id, &name, &desc, &isActive, &settings, &myRole, &memberCount); err != nil {
			continue
		}
		teams = append(teams, gin.H{
			"id":           id,
			"name":         name,
			"description":  desc,
			"is_active":    isActive,
			"settings":     settings,
			"my_role":      myRole,
			"member_count": memberCount,
		})
	}
	if teams == nil {
		teams = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{"data": teams})
}

// ── Helpers ─────────────────────────────────

// getTeamID extracts team ID from either :id (admin routes) or :teamId (team-scoped routes).
func getTeamID(c *gin.Context) string {
	if id := c.Param("teamId"); id != "" {
		return id
	}
	return c.Param("id")
}

// isUniqueViolation checks if a PG error is a unique constraint violation.
func isUniqueViolation(err error) bool {
	if err == nil {
		return false
	}
	return strings.Contains(err.Error(), "duplicate key")
}

// IsTeamAdmin checks if a user is an admin of the given team.
func IsTeamAdmin(userID, teamID string) bool {
	var role string
	err := database.DB.QueryRow(`
		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
	`, teamID, userID).Scan(&role)
	return err == nil && role == "admin"
}

// IsTeamMember checks if a user belongs to the given team (any role).
func IsTeamMember(userID, teamID string) bool {
	var exists bool
	database.DB.QueryRow(`
		SELECT EXISTS(SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2)
	`, teamID, userID).Scan(&exists)
	return exists
}

// enforcePrivateProviderPolicy checks if a user belongs to any team that
// requires private providers, and if so, verifies the resolved config is
// marked as private. Returns nil if allowed, error if blocked.
func enforcePrivateProviderPolicy(userID, configID string) error {
	if configID == "" {
		return nil
	}

	// Check if user belongs to any team with require_private_providers policy
	var requiresPrivate bool
	err := database.DB.QueryRow(`
		SELECT EXISTS(
			SELECT 1 FROM team_members tm
			JOIN teams t ON t.id = tm.team_id
			WHERE tm.user_id = $1
			  AND t.is_active = true
			  AND t.settings->>'require_private_providers' = 'true'
		)
	`, userID).Scan(&requiresPrivate)
	if err != nil || !requiresPrivate {
		return nil
	}

	// User is in a restricted team — verify the config is private
	var isPrivate bool
	err = database.DB.QueryRow(`
		SELECT COALESCE(is_private, false) FROM api_configs WHERE id = $1
	`, configID).Scan(&isPrivate)
	if err != nil {
		return nil // config lookup failed, allow (fail open)
	}
	if !isPrivate {
		return fmt.Errorf("your team requires private providers — this provider sends data externally")
	}
	return nil
}